Many automotive systems in vehicles manufactured today are controlled by electronic control modules. These electronic control modules typically include one or more microprocessors that are linked by multiple buses and that control systems as wide ranging as a fuel injection systems, brake systems, and power-assist steering systems. The correct operation of these microprocessors and the control modules in which they reside are critical to the safe operation of the vehicle.
For example, with respect to power-assist steering, a turn of a steering wheel causes electronic signals which represent torque and steering wheel position to be sent to a control module. Based on these conveyed signals and a vehicle speed sent by another module, the steering-assist module generates control signals that cause assistance to be provided to an operator of the vehicle in the turning of the vehicle's wheels. A malfunctioning of the control module could have disastrous consequences. For example, a vehicle operator may be making a left-hand turn while a malfunctioning control module provides right-hand turn assistance. In such a situation, it is preferable to disable the power-assist steering system altogether and allow the vehicle operator to manually steer the vehicle.
One method of verifying the integrity of microprocessor operation is through redundant systems. A control module contains two microprocessors, a primary microprocessor and an auxiliary microprocessor. The primary microprocessor executes a main control algorithm and the auxiliary microprocessor executes some form of the main control algorithm (either a duplicate of the algorithm or a simplified version of the algorithm). The results of each computation are then compared to ensure that they both agree or are within a certain margin of error.
The use of the dual microprocessor scheme is expensive, especially when the auxiliary microprocessor is performing functions redundant of functions performed by the primary microprocessor. Furthermore, the execution of the same program by primary and auxiliary microprocessors and the comparison of the results within a range of error does not test the buses associated with the primary microprocessor, which can also be a source of system error. In addition, in the dual microprocessor scheme, when software changes are made to the primary microprocessor the changes will also need to be implemented in the auxiliary microprocessor.
Therefore, a need exists for a method and an apparatus for verifying the integrity of control module operation, in particular the integrity of the operation of a microprocessor bus lines associated with the microprocessor, and that does not require the execution of redundant algorithms.